The current way the mask is built can overflow with a 64-bit decrementer.
Use sextract64() to extract the signed values and remove the logic to
handle negative values which has become useless.
Cc: Luis Fernando Fujita Pires <luis.pires@eldorado.org.br>
Fixes: a8dafa525181 ("target/ppc: Implement large decrementer support for TCG")
Signed-off-by: Cédric Le Goater <clg@kaod.org>
---
hw/ppc/ppc.c | 20 +++++++++-----------
1 file changed, 9 insertions(+), 11 deletions(-)
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index b813ef732ec1..f5d012f860af 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -821,14 +821,12 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
CPUPPCState *env = &cpu->env;
ppc_tb_t *tb_env = env->tb_env;
uint64_t now, next;
- bool negative;
+ int64_t signed_value;
+ int64_t signed_decr;
/* Truncate value to decr_width and sign extend for simplicity */
- value &= ((1ULL << nr_bits) - 1);
- negative = !!(value & (1ULL << (nr_bits - 1)));
- if (negative) {
- value |= (0xFFFFFFFFULL << nr_bits);
- }
+ signed_value = sextract64(value, 0, nr_bits);
+ signed_decr = sextract64(decr, 0, nr_bits);
trace_ppc_decr_store(nr_bits, decr, value);
@@ -850,16 +848,16 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
* On MSB edge based DEC implementations the MSB going from 0 -> 1 triggers
* an edge interrupt, so raise it here too.
*/
- if ((value < 3) ||
- ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && negative) ||
- ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && negative
- && !(decr & (1ULL << (nr_bits - 1))))) {
+ if ((signed_value < 3) ||
+ ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && signed_value < 0) ||
+ ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && signed_value < 0
+ && signed_decr >= 0)) {
(*raise_excp)(cpu);
return;
}
/* On MSB level based systems a 0 for the MSB stops interrupt delivery */
- if (!negative && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
+ if (signed_value >= 0 && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
(*lower_excp)(cpu);
}
--
2.31.1
From: Cédric Le Goater <clg@kaod.org>
> The current way the mask is built can overflow with a 64-bit decrementer.
> Use sextract64() to extract the signed values and remove the logic to handle
> negative values which has become useless.
>
> Cc: Luis Fernando Fujita Pires <luis.pires@eldorado.org.br>
> Fixes: a8dafa525181 ("target/ppc: Implement large decrementer support for
> TCG")
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Luis Pires <luis.pires@eldorado.org.br>
Thanks,
--
Luis Pires
Instituto de Pesquisas ELDORADO
Aviso Legal - Disclaimer <https://www.eldorado.org.br/disclaimer.html>
On Mon, Sep 20, 2021 at 08:12:03AM +0200, Cédric Le Goater wrote:
> The current way the mask is built can overflow with a 64-bit decrementer.
> Use sextract64() to extract the signed values and remove the logic to
> handle negative values which has become useless.
>
> Cc: Luis Fernando Fujita Pires <luis.pires@eldorado.org.br>
> Fixes: a8dafa525181 ("target/ppc: Implement large decrementer support for TCG")
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Applied to ppc-for-6.2, thanks.
> ---
> hw/ppc/ppc.c | 20 +++++++++-----------
> 1 file changed, 9 insertions(+), 11 deletions(-)
>
> diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
> index b813ef732ec1..f5d012f860af 100644
> --- a/hw/ppc/ppc.c
> +++ b/hw/ppc/ppc.c
> @@ -821,14 +821,12 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
> CPUPPCState *env = &cpu->env;
> ppc_tb_t *tb_env = env->tb_env;
> uint64_t now, next;
> - bool negative;
> + int64_t signed_value;
> + int64_t signed_decr;
>
> /* Truncate value to decr_width and sign extend for simplicity */
> - value &= ((1ULL << nr_bits) - 1);
> - negative = !!(value & (1ULL << (nr_bits - 1)));
> - if (negative) {
> - value |= (0xFFFFFFFFULL << nr_bits);
> - }
> + signed_value = sextract64(value, 0, nr_bits);
> + signed_decr = sextract64(decr, 0, nr_bits);
>
> trace_ppc_decr_store(nr_bits, decr, value);
>
> @@ -850,16 +848,16 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
> * On MSB edge based DEC implementations the MSB going from 0 -> 1 triggers
> * an edge interrupt, so raise it here too.
> */
> - if ((value < 3) ||
> - ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && negative) ||
> - ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && negative
> - && !(decr & (1ULL << (nr_bits - 1))))) {
> + if ((signed_value < 3) ||
> + ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && signed_value < 0) ||
> + ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && signed_value < 0
> + && signed_decr >= 0)) {
> (*raise_excp)(cpu);
> return;
> }
>
> /* On MSB level based systems a 0 for the MSB stops interrupt delivery */
> - if (!negative && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
> + if (signed_value >= 0 && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
> (*lower_excp)(cpu);
> }
>
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
On Mon, Sep 20, 2021 at 08:12:03AM +0200, Cédric Le Goater wrote:
> The current way the mask is built can overflow with a 64-bit decrementer.
> Use sextract64() to extract the signed values and remove the logic to
> handle negative values which has become useless.
>
> Cc: Luis Fernando Fujita Pires <luis.pires@eldorado.org.br>
> Fixes: a8dafa525181 ("target/ppc: Implement large decrementer support for TCG")
> Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
LGTM, but not applying because of the comments on 3/4.
> ---
> hw/ppc/ppc.c | 20 +++++++++-----------
> 1 file changed, 9 insertions(+), 11 deletions(-)
>
> diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
> index b813ef732ec1..f5d012f860af 100644
> --- a/hw/ppc/ppc.c
> +++ b/hw/ppc/ppc.c
> @@ -821,14 +821,12 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
> CPUPPCState *env = &cpu->env;
> ppc_tb_t *tb_env = env->tb_env;
> uint64_t now, next;
> - bool negative;
> + int64_t signed_value;
> + int64_t signed_decr;
>
> /* Truncate value to decr_width and sign extend for simplicity */
> - value &= ((1ULL << nr_bits) - 1);
> - negative = !!(value & (1ULL << (nr_bits - 1)));
> - if (negative) {
> - value |= (0xFFFFFFFFULL << nr_bits);
> - }
> + signed_value = sextract64(value, 0, nr_bits);
> + signed_decr = sextract64(decr, 0, nr_bits);
>
> trace_ppc_decr_store(nr_bits, decr, value);
>
> @@ -850,16 +848,16 @@ static void __cpu_ppc_store_decr(PowerPCCPU *cpu, uint64_t *nextp,
> * On MSB edge based DEC implementations the MSB going from 0 -> 1 triggers
> * an edge interrupt, so raise it here too.
> */
> - if ((value < 3) ||
> - ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && negative) ||
> - ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && negative
> - && !(decr & (1ULL << (nr_bits - 1))))) {
> + if ((signed_value < 3) ||
> + ((tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL) && signed_value < 0) ||
> + ((tb_env->flags & PPC_DECR_UNDERFLOW_TRIGGERED) && signed_value < 0
> + && signed_decr >= 0)) {
> (*raise_excp)(cpu);
> return;
> }
>
> /* On MSB level based systems a 0 for the MSB stops interrupt delivery */
> - if (!negative && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
> + if (signed_value >= 0 && (tb_env->flags & PPC_DECR_UNDERFLOW_LEVEL)) {
> (*lower_excp)(cpu);
> }
>
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
© 2016 - 2026 Red Hat, Inc.